Third Party Harassment Risk Assessment

Your policy covers how colleagues treat each other. It almost certainly does not cover the client who makes remarks in every meeting, the contractor on site, or the caller who turns abusive on a Teams call.

That gap is now yours. Under the Employment Rights Act 2025, you can be liable for harassment of your staff by third parties unless you took all reasonable steps to prevent it. It covers every protected characteristic: age, disability, race, religion, sex, sexual orientation and gender reassignment.

The old rule waited for a third incident. That rule is gone. And since 1 October 2026, staff have six months to bring a tribunal claim, not three.

Housing officers visiting tenants at home.

Professional services staff in client meetings and at client events.

Tech and support teams handling customer calls.

Contractors and engineers working on other people's sites.

Charity staff and volunteers working with the public.

Anyone at work events where alcohol is served.

If a claim lands, the first question is simple: what did you do before it happened? "We have a policy" is not enough. The duty is to prevent, not just respond.

A documented risk assessment is the evidence. It shows you looked for the risk, found it, and acted on it.

1. Map every contact point. Every role and setting where your staff meet clients, customers, contractors or the public.

2. Score the risk. Lone working, power imbalances, high stress interactions, events, travel.

3. Hear from your staff. What is really happening, including what never gets reported.

4. Check your safeguards. Policies, reporting routes, contract terms, and how complaints about third parties are handled.

5. Deliver your action plan. A written, board ready plan with owners and dates.

6. Train the people who need it most. Targeted sessions for managers and high risk teams, including active bystander training.

We deliver at your offices anywhere in the UK, or on Teams.

We are a training consultancy for people, culture and risk. We don't just explain the law. We sit with your teams, find the real risk and fix it.

Our past work includes Lloyds Banking Group and the Met Police.

Does this apply to small employers?

Yes. The duty applies to every employer. What counts as reasonable depends on your size and risk.

We already have a harassment policy. Is that enough?

Usually not. Most policies only cover colleagues. Third party risk needs its own assessment, reporting routes and response plan.

Is this legal advice?

No. We are not a law firm. We assess your culture and risk, train your people and give you a practical plan. Many clients use it alongside their legal advisers.

Book a free 20 minute call. We will tell you plainly where your biggest third party risks are and what to do first.